Bug 2536270 (CVE-2026-90064) - CVE-2026-90064 kernel: drm/xe: Reject page faults from non-fault-mode scratch VMs
Summary: CVE-2026-90064 kernel: drm/xe: Reject page faults from non-fault-mode scratch...
Keywords:
Status: NEW
Alias: CVE-2026-90064
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 17:13 UTC by OSIDB Bzimport
Modified: 2026-10-13 12:19 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 17:13:31 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Reject page faults from non-fault-mode scratch VMs

Having scratch enabled does not make a VM capable of handling recoverable
page faults. Allowing scratch VMs through the ASID lookup also admits
dma-fence mode VMs.

If such a VM faults on an already valid VMA, the handler reports success
without fixing the fault, causing the GPU to retry indefinitely.

Only allow fault-mode VMs through the ASID lookup. Fault-mode VMs using
scratch remain supported, while faults from 3D VMs are rejected.

(cherry picked from commit bfb24a06405b652d37831f3fb66b71d33a6605de)
Note You need to log in before you can comment on or make changes to this bug.